v26.1.10

[tyson-redpanda]

Features

• New live-reloadable cluster configs oidc_http_proxy_username /
  oidc_http_proxy_password add HTTP Basic authentication to the OIDC forward
  proxy (oidc_http_proxy_url); set both to authenticate, leave unset for an
  anonymous proxy. The password is secret. by @nguyen-andrew in #30767

Bug Fixes

• Fix schema evolution incorrectly rejecting new optional Iceberg columns whose nested types contain structurally-required fields (e.g. maps, whose keys are always required). by @nvartolomei in #30590
• Fixed Avro schema lookup false negatives when equivalent nested primitive schemas used simple form, such as "string", and object form, such as {"type":"string"}. by @pgellert in #30641
• Fixed a leak in the Iceberg translation subsystem where per-partition
  metrics were not released after a partition was removed from a broker. by @nvartolomei in #30706
• Fixes a bug in the feature_table in which nodes which are holding back the cluster-wide cluster_version, when decommissioned, result in the cluster_version never being updated until a restart/controller leadership move is forced. by @WillemKauf in #30636
• Fixes a bug where fetches against tiered storage could fail when retention advances past all segments and new segments are added. by @wdberkeley in #30637
• Patched krb5 against CVE-2026-40355 (null pointer dereference) and CVE-2026-40356 (integer underflow) in NegoEx message parsing, both exploitable by an unauthenticated remote attacker to crash the process (CVSS 8.7). by @tyson-redpanda in #30572
• The day partition transform now produces a date-typed partition
  column (matching the Iceberg spec) instead of int. by @mmaslankaprv in #30534
• report Iceberg-disabled topics as DISABLED in translation_state response. by @bharathv in #30770

Improvements

• Added a new cluster property iceberg_default_schema_case_insensitive with possible values of yes, no, or auto, default is auto. This property determines whether the Iceberg subsystem compares field names case-insensitively or not. The auto value means the system will attempt to detect if it should use case insensitive comparison. This will happen if the detected REST catalog is AWS Glue, which addresses a sporadic issue with AWS Glue where it would return field names lower-cased instead of verbatim. by @wdberkeley in #30577
• Avoid recompression of unchanged batches in the local storage and cloud topics compaction implementation. by @WillemKauf in #30672
• Optimize the segment_meta_cstore::insert_entries() path for the generic append case. by @WillemKauf in #30610
• Prevent oversized allocations in the kafka layer when utilizing large consumer groups by @WillemKauf in #30753
• Purging an Iceberg table managed by the filesystem catalog will now delete all the table's files, not just the metadata files. by @wdberkeley in #30698
• The iceberg translation state REST endpoint now returns a partition
  state entry for every partition of the topic and reports the topic's
  partition_count. by @mmaslankaprv in #30657

Full Changelog: v26.1.9...v26.1.10

---

This discussion was created from the release v26.1.10.